CVE-2023-25581
Published: 10 October 2024
Summary
CVE-2023-25581 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Portswigger (inferred from references). Its CVSS base score is 9.2 (Critical).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
pac4j is a security framework for Java applications, and the pac4j-core library prior to version 4.0.0 contains a deserialization vulnerability (CWE-502) in the UserProfile class. Systems that store externally controlled values in UserProfile attributes are affected; an attacker can supply an attribute containing a serialized Java object prefixed with {#sb64} and Base64-encoded, which the InternalAttributeHandler will deserialize. Although a RestrictedObjectInputStream limits the allowed classes, the permitted packages remain broad enough to support gadget chains that can result in remote code execution.
An unauthenticated attacker who can influence UserProfile attributes—typically through session storage, authentication flows, or direct attribute injection—can trigger the deserialization and achieve arbitrary code execution on the server. The attack requires network access but no user interaction, consistent with the CVSS 9.2 rating.
The referenced GitHub Security Lab advisory and pac4j source commit indicate that the issue is resolved in pac4j 4.0.0 and later; users are advised to upgrade, and the project states there are no known workarounds for earlier versions.
EPSS scores rose from a low baseline to a peak of 0.2105 (current value 0.1426), indicating that exploitation interest increased after disclosure and that the CVE merits renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2974
Vulnerability details
pac4j is a security framework for Java. `pac4j-core` prior to version 4.0.0 is affected by a Java deserialization vulnerability. The vulnerability affects systems that store externally controlled values in attributes of the `UserProfile` class from pac4j-core. It can be exploited…
more
by providing an attribute that contains a serialized Java object with a special prefix `{#sb64}` and Base64 encoding. This issue may lead to Remote Code Execution (RCE) in the worst case. Although a `RestrictedObjectInputStream` is in place, that puts some restriction on what classes can be deserialized, it still allows a broad range of java packages and potentially exploitable with different gadget chains. pac4j versions 4.0.0 and greater are not affected by this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing supplies malicious serialized objects, detecting unsafe deserialization and supporting corrective actions.
Evaluation of untrusted data handling (deserialization testing) reveals unsafe processing, which the required remediation process addresses.
Untrusted serialized data can be deserialized and observed inside the chamber, blocking gadget-chain exploitation outside the sandbox.
Validates or rejects untrusted serialized data before deserialization occurs.
Identifies and blocks malicious code introduced through deserialization of untrusted data at system boundaries.
Integrity verification of serialized information can detect tampering before deserialization occurs.
Provenance of associated data allows detection of untrusted sources before deserialization or processing occurs.